Numerical targets and legal limits in Safety Assessment Principles for Nuclear Facilities - an explanatory note. December 2006

Transcription

1 Numerical targets and legal limits in Safety Assessment Principles for Nuclear Facilities - an explanatory note December 2006

2 INTRODUCTION 1. Many comments, questions and requests for clarification were raised during the stakeholder engagement phase of the revised Safety Assessment Principles 1 (SAPs), particularly concerning the Numerical Targets and Legal Limits section. The purpose of this note is to explain the background and reasons for these targets, particularly for those that are new. It also provides clarification of some of the terms used in the targets and includes reasons for the reductions in several of the Basic Safety Levels (BSLs) and Basic Safety Objectives (BSOs). Most of the targets are not mandatory. However, some of the BSLs are legal limits in the Ionising Radiations Regulations (IRR). They are identified as BSL(LL). 2. Unless stated otherwise, references in this document to paragraph nnn or Principle xyz.n are references to the revised SAPs 1. BACKGROUND CONSIDERATIONS BSL/BSO 3. The BSLs and BSOs translate the Tolerability of Risk (TOR) 3 framework and guide decision making by inspectors. HSE policy is that the BSLs indicate doses/risks which new facilities should meet and they provide benchmarks for existing facilities (see paragraph 572, which indicates some caveat on the policy for new facilities) *. It is important to recognise that the BSO doses/risks have been set at a level where HSE considers it not to be a good use of its resources or taxpayers money, nor consistent with a proportionate regulatory approach, to pursue further improvements in safety. In contrast, licensees have an overriding duty to consider whether thay have reduced risks to as low as reasonably practicable (ALARP) on a case by case basis irrespective of whether the BSOs are met. As such, it will in general be inappropriate for licensees to use the BSOs as design targets, or as surrogates to denote when ALARP levels of dose or risk have been achieved. Occupational dose trends in normal operation 4. There has been a sustained downward trend in occupational doses during the last 20 years. Doses now are significantly lower on average than in the early 1990 s when the 1992 SAPs 4 were written. According to statistics from the Central Index of Dose Information 5 (CIDI), average doses in the nuclear industry have reduced by more than a factor of three during the period In consequence, a number of the BSO levels have been reduced to reflect this trend. It is important to note that these reductions in the BSO levels have not been prompted by reviews of risk estimates, which have not changed significantly. Dose Estimates 5. In estimating doses for comparison with these targets, all relevant sources of ionising radiation should be considered. If the target relates to the site, all sources on the site should be included, not just those in a particular facility. Where relevant, the dose contribution from any authorised discharge of radioactivity arising from planned operations should also be taken into account. Natural background radiation should however be omitted from the dose estimates, although radon may require consideration. The sources of interest are those that are introduced to the site by man for the purposes of work with ionising radiation, or that result from such work. * For ease of writing, this document does not apply the caveats appropriate to existing sites and refers only to the need to meet BSLs. First edition, December 2006 Page 1 of 15

3 NUMERICAL TARGETS FOR FAULT ANALYSIS 6. The Fault Analysis section of the SAPs describes three forms of analysis used to establish the safety case for fault and accident conditions, namely design basis analysis, probabilistic safety assessment and severe accident analysis. These all provide important qualitative and complementary inputs to the design, operation and emergency preparedness of the facility. The results of the fault analysis are also judged against numerical targets, as described below. The basis of the numerical targets themselves is discussed later in this note. Design Basis Analysis (DBA) 7. According to Principle FA.4, DBA should provide a robust demonstration of the fault tolerance of the engineering design and the effectiveness of the safety measures. This means having high confidence that there will be no significant radiological consequences, either off the site or on the site, from any reasonably foreseeable event. The SAPs ask for this to be achieved by the provision of safety measures to prevent or terminate fault sequences before exposure to direct radiation or any release/significant unintended relocation of radioactive material occurs. If this cannot be achieved, the safety measures should mitigate the radiological consequences of such fault sequences (Principle EKP.5 and paragraph 146). 8. The DBA is focussed on the key safety measures for those initiating events that are most significant in terms of frequency and unmitigated potential consequences. Paragraph 521 sets out qualitative success criteria that the safety measures should ideally achieve in a design basis fault sequence (in accordance with the conditions specified in paragraphs 516 to 520). These qualitative criteria are interpreted numerically in the BSOs of Target 4 in terms of mitigated radiological doses (ie those following successful application of the safety measures). Target 4 also caters for cases where it does not prove reasonably practicable to provide safety measures that render doses insignificant on the site or prevent a release off the site. The BSLs in such cases, again in terms of mitigated radiological doses, are set out in Target 4. Since DBA is intended to provide a robust demonstration of the fault tolerance of the engineering design, the associated consequence calculations should be carried out applying a conservative methodology; the BSOs and BSLs in Target 4 have been set on this basis. 9. Experience with the 1992 SAPs has shown that strict application of the DBA criteria as defined by P20-27 of the 1992 SAPs is disproportionate for many facilities containing radioactive material in smaller quantities and with less dispersion potential than power reactors. P16 of the 1992 SAPs called for all initiating faults with a "significant" consequence to be considered, and P21 of the 1992 SAPs called for all those with initiating fault frequencies greater than 1 x 10-5 /yr to be included in the DBA. In the revised SAPs we have clarified this by introducing explicit dose thresholds to guide inspectors on the meaning of "significant" in different contexts. Principle FA.5 defines these thresholds with reference to Target 4 (see paragraph 514 (d)): faults deemed significant enough to warrant DBA are those whose unmitigated consequences (ie those that would arise in the absence of safety measures or other interventions, calculated on a conservative basis) would exceed the relevant Target 4 BSL. 10. Target 4 is thus intended to be applied in two different ways when assessing a licensee s DBA. Firstly, DBA should be employed for any qualifying fault sequence whose unmitigated consequences could exceed the relevant Target 4 BSL. Secondly, the results of the DBA, namely mitigated dose consequences as a function of initiating fault frequencies, are compared with the relevant BSOs and BSLs in order First edition, December 2006 Page 2 of 15

4 to assist judgements on whether the associated risks are reduced ALARP. The basis for setting the numerical values used in Target 4 is described later in this note. Probabilistic Safety Assessment (PSA) 11. PSA looks at a wider range of fault sequences, including those where there are additional failures in the safety measures over and above those specified in paragraphs 516 to 519, and including initiating faults excluded from the DBA by virtue of paragraph 514. It allows full incorporation of the reliability and failure probability of the safety measures and other features of the design and operations, as described in paragraph 532. The analyses of fault progression leading to the radiological consequences of each fault sequence (whether in the design basis or not) should be carried out on a best estimate basis throughout (see paragraph 535). The PSA results can be grouped to give estimates of the frequency of occurrence of consequences within specified ranges of dose, both on the site and off the site. Targets 6 and 8 provide BSOs and BSLs for individual fault sequences, and in the case of Target 8, also for summed frequencies for all faults affecting a single facility. Similarly, Targets 5 and 7 provide BSLs and BSOs for the overall (summed) risk impact to individuals from all the facilities on a site. 12. The BSLs and BSOs in Targets 5 to 8 have been set at a level judged appropriate for a full-scope PSA (ie one in which all qualifying faults at the site/facility are included). If a reduced-scope PSA is to be assessed then these BSLs and BSOs will need to be adjusted accordingly. Similarly, inspectors may need to apply other adjustments to these Targets to take account of aspects of the licensee s methodology that differ from what was assumed when these Targets were set (cf paragraphs 576 and 608). Severe Accident Analysis (SAA) 13. The third element of the fault analysis, severe accident analysis, considers significant but unlikely accidents and provides information on their progression and consequences, within the facility, on the site and also beyond the site boundary. This is used, for example, to inform emergency response measures that could be taken to limit doses. The SAA forms an input to the PSA, and thus there is no separate Numerical Target specific to SAA. However the SAA will be particularly important in assessing the overall impact of the site in terms of the risks of major accidents that could lead to significant societal effects. This is addressed in Target 9 on societal risk. First edition, December 2006 Page 3 of 15

5 TARGETS Normal operation Normal operation any person on the site Target 1 The targets and a legal limit for effective dose in a calendar year for any person on the site from sources of ionising radiation are: Employees working with ionising radiation: BSL(LL): 20 msv BSO: 1 msv Other employees on the site: BSL: 2 msv BSO: 0.1 msv Note that there are other legal limits on doses for specific groups of people, tissues and parts of the body (IRR). 14. This target, which relates to normal operation doses, is an update of P11 in the 1992 SAPs. Some of the terms have changed, for example reference is made to employees working with ionising radiation and other employees in order to be more consistent with IRR. Employees working with ionising radiation 15. Work with ionising radiation has the same interpretation as in IRR. Employees involved with such work are likely to require regular and frequent access to areas where they are exposed to ionising radiation or where special precautions are required to restrict their exposure. Such employees are regarded as employees working with ionising radiation. 16. The BSL value of 20 msv/yr for employees working with ionising radiation is the IRR annual dose limit for employees and is denoted by BSL(LL). Using the currently accepted dose/risk value of 4 x 10-2 per Sv for a working population, the value of 20 msv equates to an annual risk of death of 8 x 10-4, which is slightly lower than 1 x 10-3 /yr proposed in Reducing Risks, Protecting People (R2P2) 6 as the limit of tolerability for the risk to workers from all sources. R2P2 represents HSE policy on all risks to people from work activities. 17. R2P2 sets the corresponding broadly acceptable risk level at 1 x 10-6 /yr. This value equates to an annual dose of msv, which is well below dose levels that would normally be reasonably practicable for employees working with ionising radiation. Recognising this, the BSO was set in the 1992 SAPs at 2 msv/yr. However, in view of the recent trends in dose reduction discussed earlier, the BSO has been reduced to 1 msv/yr, which is considered to be more representative of the current ALARP level. The revised value of 1 msv/yr corresponds to a fatality risk of 4 x 10-5 /yr. Although this BSO continues to exceed the broadly acceptable level set out in R2P2, it is judged to represent what is likely to be reasonably practicable given recent trends in dose reduction. Other employees on the site 18. Other employees on the site are those employees on a site where work with ionising radiation is carried out, who would not normally be exposed to ionising radiation in the course of their work. These include, for example, employees who would not normally enter radiation controlled areas to carry out work, or who would not be required to First edition, December 2006 Page 4 of 15

6 take special precautions to restrict their exposures to ionising radiation, eg by wearing personal protective equipment. 19. Paragraph 60 of the Approved Code of Practice (ACoP) 2 for IRR states that particular steps should be taken to restrict the exposures of any employees who would not normally be exposed to ionising radiation in the course of their work, and that dose control measures should make it unlikely that such persons would receive a dose greater than 1 msv/yr. The BSL is therefore set at 2 msv/yr, a value which should readily accommodate the unlikely doses greater than 1 msv/yr, and below which reasonably practicable dose control measures should be capable of restricting exposures. 20. The BSO for other employees on the site should be significantly lower than 1 msv/yr, which is the BSO for employees working with ionising radiation, and also lower than 0.5 msv/yr, the corresponding BSO in the 1992 SAPs, in order to reflect the downward dose trend over recent years. A value of 0.1 msv/yr has thus been adopted. This dose, which like the BSO for employees working with ionising radiation, is a factor of 20 below the BSL, corresponds to an annual risk of fatality of 4 x 10-6 /yr. Although this exceeds the broadly acceptable level of 1 x 10-6 /yr in R2P2, it should be noted that the requirement for doses to be kept ALARP will, in many cases, result in doses below the 1 x 10-6 /yr risk level. Other persons on the site 21. In the 1992 SAPs there is reference in P11 to members of the public. The dose limit for other persons (see Schedule 4 of IRR) also applies to members of the public whether they are on or off the site and therefore no additional limit is specified for members of the public on the site. It should be unlikely for a member of the public to be in a facility or on the site to the extent that their exposure to ionising radiation would influence the facility design and operation. We consider it more appropriate for such persons to be controlled by management arrangements, as highlighted in paragraph 588, in order to restrict their exposures in accordance with IRR. Normal operation any group on the site Target 2 The targets for average effective dose in a calendar year to defined groups of employees working with ionising radiation are: BSL: 10 msv BSO: 0.5 msv 22. Collective dose budgets are often determined at the design stage and, combined with the estimated number of employees working with ionising radiation, provide information on the average doses to defined groups of employees. Although there are no IRR limits for the average dose received by a group of employees, nevertheless such doses should be constrained to less than the maximum dose to an individual employee. The BSL and BSO values are set at 10 msv/yr and 0.5 msv/yr respectively, ie half the dose values for an individual employee working with ionising radiation in Target 1. The levels of individual worker risk given in TOR 3 have remained unchanged in R2P2. The BSL level thus remains unchanged from the level in the 1992 SAPs. The BSO has however been reduced in line with reducing dose trends as explained above. First edition, December 2006 Page 5 of 15

7 Normal operation any person off the site Target 3 The target and a legal limit for effective dose in a calendar year for any person off the site from sources of ionising radiation originating on the site are: BSL(LL): 1 msv BSO: 0.02 msv Note that there are other legal limits to tissues and parts of the body (IRR). 23. A person off the site is regarded as any person outside the site where the facility of interest is situated. 24. The BSL is set at 1 msv/yr, which is the IRR dose limit for other persons and as such is denoted by BSL(LL). This dose equates to a fatality risk of 5 x 10-5 /yr (based on 5% per Sv for members of the general population) which, although lower than the fatality risk of 1 x 10-4 /yr proposed in R2P2 for members of the public, retains the value used in the 1992 SAPs. 25. The BSO, which at 0.02 msv/yr is unchanged from the 1992 SAPs, equates to the 1 x 10-6 /yr level proposed in R2P2 as the broadly acceptable risk to an individual of dying from a particular cause. It is a relatively low dose but one which evidence to the Hinkley Point C Public Inquiry 7 suggested corresponds to an ALARP level for new facilities on 'green-field' sites. It is appropriate therefore for new facilities designed to modern standards, although a less onerous ALARP level may be more realistic on multi-facility sites housing older facilities. 26. Where there are multiple sites in close proximity, it is important to ensure that the overall dose to persons off these sites is below the relevant IRR dose limit. For this reason a suitable dose constraint should be applied to each site. In cases where there is more than one employer, they should co-operate to derive suitable constraints for their respective sites (see Regulation 8(3) and 15 of IRR). The Health Protection Agency (which includes the former National Radiological Protection Board) has recommended that the constraint on optimisation for a single new source should not exceed 0.3 msv/yr. HSE s current view is that a single source should be interpreted as a site under a single duty holder s control, in that it is an entity for which radiological protection can be optimised as a whole. Design basis fault sequences any person Target 4 The targets for the effective dose received by any person arising from a design basis fault sequence are: On-site BSL: 20 msv for initiating fault frequencies exceeding 1 x 10-3 pa 200 msv for initiating fault frequencies between 1 x 10-3 and 1 x 10-4 pa 500 msv for initiating fault frequencies less than 1 x 10-4 pa BSO: 0.1 msv pa Off-site BSL: 1 msv for initiating fault frequencies exceeding 1 x 10-3 pa 10 msv for initiating fault frequencies between 1 x 10-3 and 1 x 10-4 pa 100 msv for initiating fault frequencies less than 1 x 10-4 pa. BSO: 0.01 msv pa First edition, December 2006 Page 6 of 15

8 27. Having already explained the conceptual background for the DBA Target 4, it remains to set out the rationale for the BSOs and BSLs used in this target. The explanation is more easily understood by referring to Figure DBA is considered to be a demanding method of fault analysis aimed at providing a robust demonstration of the fault tolerance of a facility. Consequently, Target 4 is designed to ensure that DBA is applied in all cases where significant consequences could arise with reasonable likelihood. The target has been set largely based on 1992 SAP P25, attempting to quantify the qualitative criteria set by this principle. The approach adopted is intended to engender a proportionate approach in which the analysis is focussed on fault sequences with the potential to pose the greatest risk. 29. In this approach, faults selected for DBA are chosen on the basis of their initiating fault frequency (IFF) and potential unmitigated radiological consequence as shown in Figure 1. This figure has been derived as follows: following the approach adopted in the 1992 SAPs, only faults with IFF greater than 1 x 10-5 /yr need to be considered for DBA. This defines the lowermost section of the boundary of the DBA Region. Furthermore, 1992 SAP P25(b) indicates that doses off the site of up to 100 msv may be allowable in severe design basis fault sequences. Hence, faults with the lowest IFFs addressed by DBA, and with potential doses less than 100 msv are excluded. This defines the lowest portion of the left-hand boundary of the DBA Region. The 100 msv dose level was chosen so that the analysis would address any initiating fault that might be expected to lead to an evacuation away from the immediate vicinity of the site, taking into account the conservatism of the analysis. Appendix 2 paragraph 1 of the 1992 SAPs and the textbox following paragraph 621 of the revised SAPs provide further details of the likely consequences of off-site radiological releases. 30. For doses on the site, 1992 SAP P25(c) states that there should be no "excessive dose" following any design basis fault sequence. This has been interpreted in the revised SAPs to equate to a dose of 500 msv, since observable deterministic symptoms from accidental exposures to radiation are considered unacceptable following a design basis fault. This defines the lowest portion of the left-hand boundary of the DBA Region for doses on the site. 31. For more frequent faults having a significant probability of occurrence during the lifetime of the facility, it would be considered unacceptable if design basis safety measures were not to be provided for faults capable of exceeding the relevant BSLs of 1 msv/yr (off the site) or 20 msv/yr (on the site) in Targets 1 and 3. The applicable frequency is set at 1 x 10-3 /yr on the basis of long-standing DBA practices established for UK power reactors. This reasoning defines the upper portion of the left-hand boundary of the DBA Region in Figure The remaining portion of the DBA Region boundary has been derived based on a broadly logarithmic interpolation between the limiting cases described above, in order to engender a proportionate approach. Figure 1 is intended to provide a broad indication of where DBA might be expected to be applied and is not intended to be a rigid rule: licensees are expected to develop their own methods for defining the scope of DBA tailored to their specific circumstances. Figure 1 is provided as a generic starting point for HSE inspectors, particularly where there is no well-established licensee guidance. 33. This definition of the DBA Region should not be taken to imply that safety measures are not needed elsewhere. Initiating faults in Region 0 of Figure 1 still require consideration of possible safety measures and the application of relevant good practice to ensure risks are reduced to ALARP and in compliance with Targets 5 to 9 First edition, December 2006 Page 7 of 15

9 (see note to paragraph 514). The identification and design of these safety measures should be informed through application of PSA and SAA. 34. Target 4 also serves to define DBA success criteria (ie performance requirements) for safety measures in terms of the dose levels arising from faults following their successful operation. In keeping with the preference for safety measures that prevent or terminate fault sequences in their early stages, the BSOs have been set at a level comparable with the BSOs for operational doses in Targets 1 and 3. In cases where it is not reasonably practicable to provide safety measures that render doses insignificant on the site, or prevent a release off the site, the DBA should demonstrate safety measures are in place to reduce (ie mitigate) potential doses to levels below the relevant Target 4 BSLs, ie to inside Region 0 of Figure 1. The logic for this is as follows: any fault in the DBA Region of Figure 1 whose mitigated consequences were not in Region 0 would constitute a DBA initiating fault in its own right. The existence of such a fault would breach 1992 SAP P25. Hence the boundary between the regions in Figure 1 denotes both where HSE expects to see DBA applied, and success criteria in extreme cases where preventative safety measures are not reasonably practicable. Individual risk of death from on-site accidents any person on the site Target 5 The targets for the individual risk of death to a person on the site, from on-site accidents that result in exposure to ionising radiation, are: BSL: BSO: 1 x 10-4 pa 1 x 10-6 pa 35. Target 5 addresses the risk to individual persons on the site from all accidents that result in exposure to ionising radiation from all facilities on the site, although it is recognised that the risk is likely to be dominated by the facility where the person works. Also employees working with ionising radiation are likely to be at greater risk than other employees on the site. 36. The limiting risk to persons on the site from normal operation is set by Target 1 at 8 x 10-4 /yr. Hence the risk apportioned to accidents needs to be less than 2 x 10-4 /yr, in order to meet the upper level of 1 x 10-3 /yr set by R2P2. The revised BSL for accidents is set at 1 x 10-4 /yr which is slightly lower to provide some allowance for the difficulties and uncertainties in estimating worker risks. However, as pointed out in paragraph 604, in cases where the risk from normal operation is predicted to be well below the BSL of Target 1, higher accident risks could potentially be allowable based on the totality of the summed risks and applying a different apportionment. Any such revised apportionment would need to be adequately justified. 37. It is acknowledged that the BSO is set at a demanding level and that in some cases it may not be reasonably practicable to reduce risks to this degree. Such instances are acceptable provided it can be demonstrated that doses satisfy BSLs and have been reduced to ALARP. 38. In addition, management arrangements should identify appropriate controls to limit the doses and risks to other persons such as visitors, trainees and women of reproductive capacity. Such persons are not explicitly covered in Target 5. First edition, December 2006 Page 8 of 15

10 Frequency dose targets for any single accident any person on the site Target 6 The targets for the predicted frequency of any single accident in the facility, which could give doses to a person on the site, are: Effective dose, msv Predicted frequency per annum BSL BSO x x x x x x 10-5 > x x This target, which is subsidiary to the site Target 5, relates to the risk to persons on the site from accidents in individual facilities. This is a new target, with no analogue in the 1992 SAPs. It was originally intended that the dose-frequency staircase given here should be applied to the totality of accidents at the facility that could affect any person on the site, ie the values in the table referred to the summed frequencies of all the accidents giving rise to doses in the respective dose bands. However, it is now considered that this approach is unduly onerous, being almost an order of magnitude more demanding than existing HSE guidance (see point 5.iii of paragraph 6.2 of T/AST/003 8 ). Hence this target has been revised to apply to any single accident at the facility. Such a change restores broad agreement with existing HSE guidance. 40. The dose-frequency staircase is similar in appearance to the staircase for persons off the site in Target 8. Like Target 8, this target is designed to ensure that the greatest level of protection is applied to faults with the most significant consequences. For each step of the staircase, the limiting values of the dose and frequency correspond to a risk of death of roughly 1 x 10-4 /yr for any person at the location where the maximum exposure occurs during the accident. However, although this risk equals the site BSL in Target 5, these values are not directly comparable since the frequencies in Target 6 apply to accident frequencies at the facility giving rise to the dose and not to an individual receiving the dose. The calculated frequencies of the accidents should not normally take credit for occupancy. Any individual on the site is likely to be affected by relatively few accidents, and these will not likely be at the limiting frequency, dose or occupancy level; so the proposed dose-frequency staircase ensures that no single accident can make an excessive contribution to the overall site BSO and BSL for individual risk given in Target 5. Target 6 thus promotes a balanced approach to addressing on-site risks, focussing attention on measures that protect or mitigate the risks to groups of persons on site, even though the risk to any individual member of the group may be low. 41. The doses appearing in Target 6 have been chosen based on the IRR annual dose limit of 20 msv, multiplied by powers of 10 so that each step of the staircase represents an equal level of risk. Individual risk to people off the site from accidents Target 7 The targets for the individual risk of death to a person off the site, from on-site accidents that result in exposure to ionising radiation, are: BSL: 1 x 10-4 pa BSO: 1 x 10-6 pa First edition, December 2006 Page 9 of 15

11 42. Target 7 addresses the risk to persons off the site from all accidents that result in exposure to ionising radiation from all facilities on the site. Although this is a new target, the BSL and BSO levels were implicit in the 1992 SAPs (see Appendix 2, paragraph 6) through references to TOR 3. The target has been introduced for consistency with the approach for on-site risks. 43. The BSL for normal operation doses given in Target 3 equates to a risk of fatality of 5 x 10-5 /yr. When combined with the BSL for accidents in this target, the total risk sums to 1.5 x 10-4 /yr, which is slightly above the level proposed in R2P2 for members of the public. In practice however, it is very unlikely that the predicted risks from normal operation and from accidents will both reach their corresponding BSL levels. As such, and given the inherent uncertainties in numerical predictions of accident risk, it is argued that the chosen BSL is appropriate. Similar arguments may be employed to justify the choice of BSO. 44. It should also be noted that the BSL and BSO in this target are the same as those set for on-site risks in Target 5. This is purely coincidental and arises because the onsite risks arising from normal operation contribute a significant fraction of the R2P2 upper risk level, so that the available risk from accidents is relatively small. With this factor taken into account, the two targets become equal even though the R2P2 level for workers is an order of magnitude greater than that set for the public. The BSOs for accidents are the same, as the contribution from normal operation already exceeds the R2P2 value (see paragraph 16 of this document). Frequency dose targets for accidents on an individual facility any person off the site Target 8 The targets for the total predicted frequencies of accidents on an individual facility, which could give doses to a person off the site, are: Effective dose, msv Total predicted frequency per annum BSL BSO x x x x x x x 10-5 > x x The dose frequency staircase in Target 8 is unchanged from the 1992 SAPs (see P42). 46. Target 8 sets limits on the frequencies of classes of accident at individual facilities that could give rise to doses off the site within the specified bands. Summing the risk from each band, and assuming a probability of death equal to 1 for doses in excess of 1Sv, a plant just satisfying the BSLs would pose a risk of 3 x 10-4 /yr. However, to derive the risk to a person living nearby, account also needs to be taken of the variability of wind and weather conditions. Including these factors reduces the risk of death to an individual just outside the site from a plant that just meets the BSLs to slightly above 1 x 10-5 /yr. Similarly, a plant just meeting the BSO frequencies gives an individual risk slightly in excess of 1 x 10-7 /yr. Both of these frequencies are less than the values of 1 x 10-4 and 1 x 10-6 /yr proposed in TOR for the generality of industrial hazards. However, these are nevertheless considered appropriate risks for a single facility since the TOR values should strictly be applied for a whole site rather than for a single facility. First edition, December 2006 Page 10 of 15

12 47. Target 8 also defines limits for single fault sequences (set at one tenth of the given BSOs and BSLs see paragraph 618). Comparing this aspect of the target with Target 6, it is evident that Target 8 is broadly a factor of 10 more stringent for fault sequences affecting persons off the site than Target 6 is for sequences affecting persons on the site at the same dose consequences. This seems reasonable. 48. Although conceptually it would be possible to extend Target 8 to include further dose bands beyond 1Sv, accidents of this magnitude would, in all likelihood, affect relatively large numbers of people. As such, accidents leading to doses off the site significantly in excess of 1Sv will normally be assessed against Target 9. Total risk of 100 or more fatalities Target 9 The targets for the total risk of 100 or more fatalities, either immediate or eventual, from on-site accidents that result in exposure to ionising radiation, are: BSL: BSO: 1 x 10-5 pa 1 x 10-7 pa 49. In the 1992 SAPs, the target for frequencies of accidents that could give rise to societal consequences was given by P44, the large release SAP. P44 was couched in terms of the release of specified quantities of two particular radionuclides chosen based on the predicted resultant total number of cancer deaths that could arise. However, a number of issues related to P44 have been identified following publication and application of the 1992 SAPs. In particular problems were encountered in regard to the relationship between releases and the number of deaths, and how to define equivalent source terms for sites where the radionuclides specified in P44 are not the ones of principal concern. Although HSE commissioned research to try to resolve these problems, no satisfactory conclusion was reached. 50. In developing the revised SAPs, the issue of societal risk was re-examined and a variety of options considered for setting societal risk frequency targets. These included estimating the potential number of radiation-related deaths from a major accident, the extent to which such an accident would lead to a need to extend the detailed emergency planning zone (DEPZ) around the site, and a combination of these two considerations. 51. HSE commissioned research from the Health Protection Agency (HPA) to look at how these aspects would vary at specific UK sites encompassing a variety of source terms. Based on this research, HSE concluded that P44 should be replaced by a target set in terms of the total risk of occurrence of 100 or more immediate or eventual fatalities, on and off the site, from accidents resulting in exposure to ionising radiation. This formulation also had the advantage of being of a similar form to HSE s approach in judging the risk of multiple fatalities occurring in one event from a single major industrial activity (see R2P2 paragraph 136). An alternative formulation in which the target was based on consideration of emergency countermeasures could not be supported technically to a suitable degree. Based on the HPA studies, HSE also concluded that the calculations of accident consequences should be truncated at 100 years and limited to the effects on the UK population. In the case of accidents where the consequences are very much larger than those in Target 9, there may be a need to demonstrate correspondingly lower predicted frequencies of occurrence. 52. Target 9 is intended to be used as a guide to assist in judging whether more detailed analysis is warranted. In particular, as explained in paragraph 628, ALARP First edition, December 2006 Page 11 of 15

13 considerations may dictate applying a lower BSO and/or analysis of accidents that result in fewer than 100 deaths. 53. Although Target 9 is new way of treating societal risk, it is still consistent with the findings of the Barnes Report 7 on Hinkley Point C (which P44 was intended to address): that an event leading to one hundred to several hundred immediate or eventual deaths should not be more frequent than one in a hundred thousand years. HSE considers that there is sufficient international technical concensus on methods, data and assumptions to allow it to be applied appropriately by duty holders. In particular, work by the NEA 9 supports this view, and the use of Level 3 PSA methods has been endorsed by IAEA in NS-G , which was one of the benchmarks used during the present revision of the SAPs. P45 and P46 in the 1992 SAPs 54. The targets in the Numerical Targets and Legal Limits section of the revised SAPs relate directly to effects on people from normal operation and accidents. In contrast, P45 (frequency of significant plant damage) and P46 (accidental criticality excursions) in the 1992 SAPs do not directly concern the effects on people and have thus been removed from the revised SAPs. Nevertheless, paragraph 583 recognises the usefulness of such intermediate targets in individual circumstances, eg core damage frequency targets for operational power reactors. Where such targets feature in licensee s safety cases, their applicability will be taken into account within HSE s assessment on a case by case basis. SUMMARY 55. This note explains the background and justification for the nine targets in the Numerical Targets and Legal Limits section of the revised SAPs. Explanations are given for changes that have been introduced and for reductions in some of the BSLs and BSOs. More detailed guidance for inspectors on the application of these targets will be provided in supporting technical guidance documents to be produced in due course. First edition, December 2006 Page 12 of 15

14 REFERENCES 1 HSE Safety Assessment Principles for Nuclear Facilities. First edition, Web version: 2 Working with ionising radiation. Ionising Radiation Regulation Approved code of practice and guidance. L121 HSE Books 2000 ISBN HSE The tolerability of risk from nuclear power stations. The Stationary Office ISBN Web version: 4 HSE Safety Assessment Principles for Nuclear Plants. HSE Books 1992 ISBN Web version: 5 Occupational exposure to ionising radiation Analysis of doses reported to the Health and Safety Executive s Central Index of Dose Information, HSE report, and HSE Central Index of Dose Information, Summary Statistics for Web version: 6 Reducing risks, protecting people: HSE s decision making process. HSE Books ISBN Web version: 7 The Hinkley Point Public Inquiries: A Report by Michael Barnes QC. The Stationary Office 1990 ISBN X 8 HSE Nuclear Safety Directorate Business Management System T/AST/003 Technical Assessment Guide Safety Systems, Issue 3, Web version: 9 Probabilistic Accident Consequence Assessment Codes; Second International Report. NEA 1994, OECD, Paris. 10 Safety Assessment and Verification for Nuclear Power Plants. IAEA Safety Standards Series No. NS-G-1.2, While every effort has been made to ensure the accuracy of the references listed in this publication, their future availability cannot be guaranteed. First edition, December 2006 Page 13 of 15

15 FURTHER INFORMATION HSE priced and free publications are available by mail order from HSE Books, PO Box 1999, Sudbury, Suffolk CO10 2WA Tel: Fax: Website: (HSE priced publications are also available from bookshops and free leaflets can be downloaded from HSE s website: For information about health and safety ring HSE's Infoline Tel: Fax: Textphone: mailto:hse.infoline@natbrit.com or write to HSE Information Services, Caerphilly Business Park, Caerphilly CF83 3GG. The Stationery Office publications are available from The Stationery Office, PO Box 29, Norwich NR3 1GN Tel: Fax: mailto:customer.services@tso.co.uk, Website: (These are also available from bookshops.) This document is available web-only at: Crown copyright This publication may be freely reproduced, except for advertising, endorsement or commercial purposes. First published December Please acknowledge the source as HSE. Published by the Health and Safety Executive, December First edition, December 2006 Page 14 of 15

16 FIGURE 1. This diagram categorises initiating faults according to their initiating frequency and potential consequences 1 to persons off and on the site. It is used in the SAPs for two purposes: a) to define faults to be included in the DBA all those in the DBA Region; and b) to provide performance criteria for successful operation of safety measures for a given IFF, the mitigated consequences should be in Region 0. These two applications are reflected in the two labels given to each of the horizontal axis scales. Initiating fault frequency (IFF) (per year) 10-2 DBA Region Region msv 10 msv 100 msv a) Off-site dose in absence of safety measures b) Off-site dose in presence of safety measures 20 msv 200 msv 500 msv a) On-site dose in absence of safety measures b) On-site dose in presence of safety measures 1 N.B. Consequences should be calculated conservatively in accordance with DBA assumptions (see SAPs Fault Analysis section) First edition, December 2006 Page 15 of 15